[red-hat-konflux]

This PR contains the following updates:

Package	Change	Age	Confidence
golang.org/x/crypto	v0.57.0 → v0.59.0

---

The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues

GO-2026-5932

More information

Details

The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.

If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.

Severity

Unknown

References

• https://go.dev/issue/44226
• https://go.dev/issue/81227

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[red-hat-konflux]

ℹ️ Artifact update notice

File name: acceptance/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 6 additional dependencies were updated

Details:

Package	Change
golang.org/x/mod	v0.41.0 -> v0.42.0
golang.org/x/net	v0.58.0 -> v0.62.0
golang.org/x/sync	v0.23.0 -> v0.25.0
golang.org/x/sys	v0.48.0 -> v0.50.0
golang.org/x/term	v0.46.0 -> v0.48.0
golang.org/x/text	v0.42.0 -> v0.44.0

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 7 additional dependencies were updated

Details:

Package	Change
golang.org/x/net	v0.58.0 -> v0.62.0
golang.org/x/sync	v0.23.0 -> v0.25.0
golang.org/x/text	v0.42.0 -> v0.44.0
golang.org/x/mod	v0.41.0 -> v0.42.0
golang.org/x/sys	v0.48.0 -> v0.50.0
golang.org/x/term	v0.46.0 -> v0.48.0
golang.org/x/tools	v0.49.0 -> v0.52.0

File name: tools/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 7 additional dependencies were updated

Details:

Package	Change
golang.org/x/mod	v0.41.0 -> v0.42.0
golang.org/x/net	v0.58.0 -> v0.62.0
golang.org/x/sync	v0.23.0 -> v0.25.0
golang.org/x/sys	v0.48.0 -> v0.50.0
golang.org/x/term	v0.46.0 -> v0.48.0
golang.org/x/text	v0.42.0 -> v0.44.0
golang.org/x/tools	v0.49.0 -> v0.52.0

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Enterprise
• Run ID: d9b7e406-fea4-42e9-a50d-0324999f34cc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 5:44 AM UTC · Completed 6:00 AM UTC

Commit: 97144b8 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $3.56

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Bot-authored security dependency update bumping golang.org/x/crypto across three go.mod/go.sum files with no code logic changes, no protected paths, and no CI modifications; standard review is adequate.

[fullsend-ai-review]

Review

Findings

Low

• [data-exposure] go.mod:397 — The upgrade from golang.org/x/crypto v0.57.0 to v0.59.0 causes golang.org/x/crypto/openpgp v0.1.0-deprecated to appear as an explicit indirect dependency across all three modules (root, acceptance, tools). This is a standard Go module-split artifact: the deprecated openpgp code was already bundled inside v0.57.0 and reachable by the same transitive dependency. The PR makes this pre-existing condition visible as a separate module entry rather than introducing new attack surface. To identify the consumer, run go mod why golang.org/x/crypto/openpgp and track upgrading it to a maintained alternative (github.com/ProtonMail/go-crypto).

---

Labels: Renovate Go security dependency PRs conventionally carry dependencies and go labels alongside renovate and security.